Defining frame manually windbg

Question

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              RetFromMyFunc 

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

Answer 1

Are You Providing all the three overrides
this command is for looking at locals of a different frame
this command will work better or correct with an application having its private pdb

here is a simulated range error look how esp,ebp,eip changes in register display

0:000> r
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a005a6 esp=001af7f8 ebp=001af824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
77a005a6 cc              int     3

0:000> .frame /c /r = @ebp+1000 @esp-0x1000 @eip+0x300

00 001b0824 00000000 ntdll!LdrpCheckAppDirType+0xa4
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a008a6 esp=001ae7f8 ebp=001b0824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpCheckAppDirType+0xa4:
77a008a6 7408            je      ntdll!LdrpCheckAppDirType+0xae (77a008b0) [br=1]

0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
001b0824 00000000 ntdll!LdrpCheckAppDirType+0xa4

0:000> .cxr
Resetting default scope

0:000> k
ChildEBP RetAddr
001af824 779e0e00 ntdll!LdrpDoDebuggerBreak+0x2c
001af984 779c60a7 ntdll!LdrpInitializeProcess+0x11a9
001af9d4 779c3659 ntdll!_LdrpInitialize+0x78
001af9e4 00000000 ntdll!LdrInitializeThunk+0x10

0:000> .frame /c /r = @ebp+1000 @esp-0x1000
                                           ^ Range error in '.frame /c /r = @ebp+1000 @esp-0x1000 '

0:000> .frame /c /r = @ebp+1000 @esp-0x1000 @eip-500

00 001b0824 00000000 ntdll!LdrpLogDllRelocationEtwEvent+0x77
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a000a6 esp=001ae7f8 ebp=001b0824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpLogDllRelocationEtwEvent+0x77:
77a000a6 7f83            jg      ntdll!LdrpCorProcessImports+0x25 (77a0002b) 
[br=0]